Golang boringcrypto official location for built binaries

Srikanth Shreenivas

unread,

May 12, 2022, 5:15:12 PM5/12/22

to golang-nuts

Is there a formal documenation from go team on where one can download golang with boringcrypto?

After searching on internet, I found that distribution is available from https://go-boringcrypto.storage.googleapis.com/ which gives list of prebuilt packages and we can download the file by appending the filename to URL.

However, golang website does not mention this above link for one to be sure that it is indeed operated by golang team and is fully reliable source for golang with boringcrypto.

Or should the teams that need golang with boringcrypto should build it from source for compliance to FIPS140?

Regards,
Srikanth

Ian Lance Taylor

unread,

May 12, 2022, 5:31:48 PM5/12/22

to Srikanth Shreenivas, golang-nuts

See https://go.googlesource.com/go/+/refs/heads/dev.boringcrypto/misc/boring/README.md
which has a note about releases.

Ian

Srikanth Shreenivas

unread,

May 12, 2022, 11:11:16 PM5/12/22

to golang-nuts

Thanks. After https://github.com/golang/go/issues/51940, the https://go.googlesource.com/go/+/refs/heads/dev.boringcrypto/misc/boring/README.md is not present in "master" branch.

I do see that 1.18.2 which just got released is now available on https://go-boringcrypto.storage.googleapis.com/ even though build.release file mentioned in README.md does not exist on master branch.

It seems bit cryptic that one has to look through source code of defunct branch "dev.boringcrypto" to know how to download golang with boringcrypto.

Ian Lance Taylor

unread,

May 13, 2022, 1:31:28 AM5/13/22

to Srikanth Shreenivas, golang-nuts

On Thu, May 12, 2022 at 8:11 PM Srikanth Shreenivas <sri...@gmail.com> wrote:
>
> Thanks. After https://github.com/golang/go/issues/51940, the https://go.googlesource.com/go/+/refs/heads/dev.boringcrypto/misc/boring/README.md is not present in "master" branch.
> I do see that 1.18.2 which just got released is now available on https://go-boringcrypto.storage.googleapis.com/ even though build.release file mentioned in README.md does not exist on master branch.
>
> It seems bit cryptic that one has to look through source code of defunct branch "dev.boringcrypto" to know how to download golang with boringcrypto.

There have been significant changes to the boringcrypto process on the
main branch. Those will certainly affect boringcrypto releases for
the 1.19 release. But they don't affect the current 1.18 release.

Ian

> On Friday, May 13, 2022 at 3:01:48 AM UTC+5:30 Ian Lance Taylor wrote:
>>
>> On Thu, May 12, 2022 at 2:15 PM Srikanth Shreenivas <sri...@gmail.com> wrote:
>> >
>> > Is there a formal documenation from go team on where one can download golang with boringcrypto?
>> >
>> > After searching on internet, I found that distribution is available from https://go-boringcrypto.storage.googleapis.com/ which gives list of prebuilt packages and we can download the file by appending the filename to URL.
>> >
>> > However, golang website does not mention this above link for one to be sure that it is indeed operated by golang team and is fully reliable source for golang with boringcrypto.
>> >
>> > Or should the teams that need golang with boringcrypto should build it from source for compliance to FIPS140?
>>
>> See https://go.googlesource.com/go/+/refs/heads/dev.boringcrypto/misc/boring/README.md
>> which has a note about releases.
>>
>> Ian
>

> --
> You received this message because you are subscribed to the Google Groups "golang-nuts" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/f77852f3-caab-47fe-b2b7-6ca4c23079een%40googlegroups.com.

Reply all

Reply to author

Forward